@pellux/goodvibes-tui@2.0.15
Terminal-native GoodVibes client for coding, operations, knowledge and channel workflows; a pure client of the GoodVibes daemon.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe install hook automatically places package-owned agent instructions in the GoodVibes home directory, which warrants a warning for agent extension lifecycle risk. The inspected behavior is confined to GoodVibes-owned files and does not establish a block-eligible attack.
Decision evidence
public snapshot- The package runs scripts/postinstall.js during installation.
- The postinstall routine automatically deploys bundled files into the user's GoodVibes home directory.
- It copies GOODVIBES.md into the user's home when that file is absent; the file contains mandatory agent workflow directives.
- The setup is limited to GoodVibes-owned directories, and existing destination files are skipped.
- The inspected source does not establish credential theft, unrelated data transfer, or a broader agent configuration change.
Source & flagged code
10 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @pellux/goodvibes-tui@2.0.15.
See all versions of @pellux/goodvibes-tui for other recorded verdicts.
- Review the evidence and your use of @pellux/goodvibes-tui@2.0.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.